Agent for Windows and Server Changelog

A new version of the WithSecure Ultralight Core update (expected version 2025-05-09_01), part of the Windows endpoint client, is available and our Early access program participants will start seeing it starting on 19th of May 2025. Full availability starts one week later, on 26th of May 2025.

This release introduces a new 'wsulavprothoster' service, executing 'fsulprothoster.exe' process. For partners and customers who have custom integrations in their endpoint devices to ensure that the EPP product is functioning correctly, we advise that these integrations are reviewed to ensure correct functionality.

For more details please check Changes to the Windows EPP Scanning Components – May 2025

A new version of the Windows Ultralight Core update intended to go out to our Early Access Program participants today, 7th of May 2025, has been postponed due to issues found during the preparation phase. We apologize for the delays related to this release, but we are committed to making sure that we release content with the highest possible quality. We will advise on the release schedule for the new update.

A new version of the WithSecure Ultralight Core update (expected version 2025-04-23_02), part of the Windows endpoint client, is available and our Early access program participants will start seeing it starting on 7th of May 2025. Full availability starts one week later, on 14th of May 2025.

For more details please check Changes to the Windows EPP Scanning Components – May 2025

RohithKumar

A new version of the endpoint clients is available and our Early access program participants will start seeing it starting on 24.04.2025. Full availability starts one week later and takes some days to reach all customers.

This release makes the Elements Agent version 25.2 available (internal version 25.2.408).

The endpoints automatically upgrade, without a reboot.

This release introduces new features and fixes.

Features:

- Enhanced Lock Workstation Task: Improved the functionality of the Lock Workstation automated task to ensure it does not interrupt ongoing Microsoft Teams meetings, providing a seamless experience during active calls.

- Optimized Software Updater Rescans: Introduced a cooldown period to reduce the frequency of Software Updater rescans triggered by Windows updates, minimizing redundant scans and improving system performance.

A new version of the endpoint clients is available and our Early access program participants will start seeing it starting on 28.01.2025. Full availability starts one week later and takes some days to reach all customers.

This release makes the Elements Agent version 25.1 available (internal version 25.1.82).

The endpoints automatically upgrade, without a reboot.

This release introduces new features and fixes.

Features:

We have improved reporting of user principal name and user logon time for Entra ID users.
Agent now sends more detection data to the portal.
Agent reports two new security parameters to the portal:
- Allow log on through Remote Desktop Services:
  Lists users or groups that can access the sign-in screen of a remote device through a Remote Desktop Services connection.
- Deny log on through Remote Desktop Services:
  Lists users that are prevented from logging on to the device through a Remote Desktop connection through Remote Desktop Services.
OPSWAT certification is pending and newly released version will be added to the WithSecure - OPSWAT site as soon as the product is certified.

A new version of the endpoint clients is available and our Early access program participants will start seeing it starting on 2.12.2024. Full availability starts on 4.12.2024 and takes some days to reach all customers.

This release makes the Elements Agent version 24.6 available (internal version 24.6.339).

The endpoints automatically upgrade, without a reboot.

This release introduces minor fixes for issues identified with the 24.6.338 version.

A new version of the endpoint clients is available and our Early access program participants will start seeing it starting on 25.11.2024. Full availability starts one week later and takes some days to reach all customers.

This release makes the Elements Agent version 24.6 available (internal version 24.6.338).

The endpoints automatically upgrade, without a reboot.

This release introduces new features and fixes.

Features:

Elements Agent now supports migration from Countercept. Activating a subscription containing the EDR component uninstalls the Countercept Agent.
A new security event is sent when Elements Agent is uninstalled.
A new "Last restart time" status is sent to the portal.
Elements Agent supports configuring APIPA (automatic private internet protocol addressing) addresses in Network location settings / Locations and rules.
Elements Agent now supports Windows Server 2025.

A new version of the endpoint clients is available and our Early access program participants will start seeing it starting on 05.09.2024. Full availability starts one week later and takes some days to reach all customers.

This release makes the Elements Agent version 24.5 available (internal version 24.5.320).

The endpoints automatically upgrade, without a reboot.

This release introduces new features and fixes, if interested enable Early access to client software in General Settings of your profile for selected endpoints.

Features:

Improved compatibility between different versions of runtime libraries.
Enhanced support for detecting and scanning USB-attached SCSI disks.

A new version of the endpoint clients is available and our Early access program participants will start seeing it starting on 20.06.2024. Full availability starts one week later and takes some days to reach all customers.

This release makes the Elements Agent version 24.4 available (internal version 24.4.356).

The endpoints automatically upgrade, without a reboot.

This release introduces new features and fixes, if interested enable Early access to client software in General Settings of your profile for selected endpoints.

Features:

We have enhanced our compatibility with Squid Proxy 6 and above, ensuring smoother operations.
This release includes an updated software updater engine, providing more reliable and efficient updates.
We have enabled offload scanning in the portal's profile editor. This premium feature allows for more efficient resource usage by offloading scanning tasks.
This release includes several bug fixes, enhancing the stability and performance of our software.

LiselotteP

A new version of the Ultralight Core update, part of the Windows endpoint client, is available and our Early access program participants will start seeing it starting on 26.06.2024. Full availability starts one week later, 03.07.2024.

ORSP as a technology has been already replaced by Karma as the main interface to our Security Cloud and integration point as part of that change has been moved into the Ultralight Network Hoster service (fsulnethoster). With this release, we are removing the ORSP service (fsulorsp) and corresponding executables (fsorsp.exe / fsorsp64.exe). This should have no affect for customers, but any custom agent monitoring in place might be affected, as this change might break healthchecks.

LiselotteP

A new version of the Windows endpoint clients is available and our Early access program participants will start seeing it starting on 27.06.2024. Full availability starts in August.
This release makes the Elements Agent version 24.4 available (internal version 24.4.357).
The endpoints automatically upgrade, without a reboot.

Features:

Shell extension issue preventing users from saving documents from document editor such as MS Office, PDF24, Notepad is now fully fixed

LiselotteP

A new version of the Windows endpoint clients is available and our Early access program participants will start seeing it starting on 20.06.2024. Full availability starts in August.
This release makes the Elements Agent version 24.4 available (internal version 24.4.356).
The endpoints automatically upgrade, without a reboot.

Features:

We have enhanced our compatibility with Squid Proxy 6 and above, ensuring smoother operations.
This release includes an updated software updater engine, providing more reliable and efficient updates.
We have enabled offload scanning in the portal's profile editor. This premium feature allows for more efficient resource usage by offloading scanning tasks.

A new version of the endpoint clients is available and our Early access program participants will start seeing it starting on 02.05.2024. Full availability starts one week later and takes some days to reach all customers.

This release makes the Elements Agent version 24.3 available (internal version 24.3.300).

The endpoints automatically upgrade, without a reboot.

This release introduces new features and fixes, if interested enable Early access to client software in General Settings of your profile for selected endpoints.

Features:

This release brings several enhancements and corrections, particularly focusing on installation processes, proxy management, and automated tasks.
In this release, we have updated the name of the tool used during preparation of golden images for VDI environments (such as Citrix and others). The former name, "fs_oneclient_logout.exe", has been transitioned to the new name, "ws_oneclient_logout.exe". Please make sure to update your scripts used for setting up such images.

The previously announced Elements Agents switch to WithSecure browser extensions scheduled for early March is being postponed to April the 2nd. Administrators who already applied MDM or group policies changes are recommended to keep old F-Secure extension IDs until then.

On April 2nd, 2024, clients will start using new extensions. If browser extensions are not preinstalled via MDM or group policies, Elements Agent will automatically add extensions to the Google Chrome and Microsoft Edge, but will prompt users to activate them. Mozilla Firefox requires extensions to be preinstalled via MDM or group policies, or manually with the direct link from the WithSecure-hosted location: https://download.withsecure.com/online-safety/ws_firefox_https.xpi or Firefox Browser add-ons https://addons.mozilla.org/en-US/firefox/addon/ols-withsecure/

If extensions are missing or users do not activate them locally, the following Browsing Protection functionality will be limited:

block page for HTTPS pages (pages are still blocked)
rating icons and the SafeSearch mode for search engines
Banking Protection

A new version of the endpoint clients is available and our Early access program participants will start seeing it starting on 05.03.2024. Full availability starts one week later and takes some days to reach all customers.

This release makes the Elements Agent version 24.2 available (internal version 24.2.187).

The endpoints automatically upgrade, without a reboot.

This release introduces new features and fixes, if interested enable Early access to client software in General Settings of your profile for selected endpoints.

Features:

This release introduces new WithSecure Elements agent update mechanisms.
We are taking into use backend services that are completely distinct from the services used by F-Secure products. Therefore this release also introduces new server addresses where the endpoints connect to. Switch to the new backend services happens like the usual automatic endpoint upgrade. It requires minimal extra bandwidth.
Note that if endpoint is missing the ACS (Azure Code Signing) dependencies it won't be upgraded automatically to 24.2 (and will be automatically upgraded once there is no ACS issue anymore).
For more information see
https://community.withsecure.com/en/kb/articles/29714-changes-in-support-on-microsoft-windows-minimum-patch-level
We are pleased to announce that version 24.2 of 'WithSecure Elements EPP for Computers' and 'WithSecure Elements EPP for Computers Premium' introduces support for Windows ARM64 devices. The following features are supported:
- Heuristic & behavioral analysis
- DeepGuard
- Extensive web protection
- Firewall management
- Integrated patch management
- Device control
- Rollback

Early March Elements Agents will switch to WithSecure browser extensions:

If you use MDM or group policies to manage browser extensions it is recommended to allow or preinstall these extensions in advance.

You can follow instructions Setting up Browsing Protection via GPO user guide and use following IDs:

Google Chrome: imdndkajeppdomiimjkcbhkafeeooghd
Microsoft Edge: aambijcigikmdoehgjhdepcpieghopdl
Mozilla Firefox:
- Extensions to install: https://download.withsecure.com/online-safety/ws_firefox_https.xpi
- Prevent extensions from being disabled or removed: ols_main@withsecure.com

Old F-Secure extension IDs can be removed from MDM or group policies later in March after the switch.

Same extensions will be later used in next versions of Elements EPP for Mac.

A new version of the endpoint clients is available and our Early access program participants will start seeing it starting on 23.01.2024. Full availability starts one week later and takes some days to reach all customers.

This release makes the Elements Agent version 24.1 available (internal version 24.1.85).

The endpoints automatically upgrade, without a reboot.

This release introduces new features and fixes, if interested enable Early access to client software in General Settings of your profile for selected endpoints.

Features:

More visibility about the problems if endpoint is missing the ACS dependencies

This release adds more visibility about the problems if endpoint is missing the ACS (Azure Code Signing) dependencies.
For more information see https://community.withsecure.com/en/kb/articles/29714-changes-in-support-on-microsoft-windows-minimum-patch-level

Improved Connectivity tool report view

Connectivity tool report view has improved user experience. It's now possible to select and copy listed URLs to Clipboard.

New system event in System Events detection

A new system event (EventID 865, SoftwareRestrictionPolicies) will be available in system events detection.
This event is triggered (if enabled in profile) when user attempted to run a program that is not allowed by the policy.

Tatu

A new version of the endpoint clients is available and our Early access program participants will start seeing it starting on 29.11.2023. Full availability starts one week later and takes some days to reach all customers.

This release makes the Elements Agent version 23.9 available (internal version 23.9. 204).

The endpoints automatically upgrade, without a reboot.

This release introduces new features and fixes, if interested enable Early access to client software in General Settings of your profile for selected endpoints.

Features:
Cancel postponed remote operations

We enhanced the remote operations by providing admins to possibility to cancel postponed remote operation(s). Remote operations which can be canceled are:

Send the device a message
Install software updates

Now it is possible to cancel single remote operation or to cancel all postponed remote operations from the which support cancellation. This feature requires portal release to come visible for the users.

It is possible to cancel single operation from Device details view Operations tab, by choosing Cancel operation from the remote operation menu.

It is also possible to cancel all postponed remote operations for the device by pressing Cancel all postponed operation button from the action panel.

When installing single update it possible to postpone operation

When installing single software update, instead of installing the update immediately, it is now possible to postpone the update to later time. This feature requires portal release to come visible for the users.

Support multiple proxies from .pac script file

In previous version multiple proxies, during install time, was supported with –proxy argument but not from the .pac file. In this release we have enhanced the support for .pac file and now .pac file can also contain multiple proxy definitions.

Remote operation to restore protection

In previous releases admins had the possibility to turn off security features from the action panel. Now we have added the possibility to restore security features from the action panel.

A new version of the endpoint clients is available and our Early access program participants will start seeing it starting on 24.10.2023. Full availability starts one week later and takes some days to reach all customers.

This release makes the Elements Agent version 23.8 available (internal version 23.8.365).

The endpoints automatically upgrade, without a reboot.

This release introduces new features and fixes, if interested enable Early access to client software in General Settings of your profile for selected endpoints.

Features:

This update includes new reliability improvements to the network installer; it handles network connectivity problems and error reporting better during the installation process.
Privacy Policy and End-User License Terms links are changed to point to WithSecure site "download.withsecure.com

The diagnostic file "fsdiag.zip" has been renamed to "wsdiag.zip".

Portal dashboard displays a warning if Elements Agent has been installed with an installer that is older than six months. For a frictionless installation we recommend using the latest possible installer.

Elements Agent installation time and Installer package creation time can be found from portal's Devices view.

Agent Settings-Automated Tasks view and Event history list have been improved to show the Automated Tasks away option. Away option allows to run automated task after user has been away for defined number of minutes.

Tatu

A new version of the endpoint clients is available and our Early access program participants will start seeing it starting on 21.09.2023. Full availability starts one week later and takes some days to reach all customers.

This release makes the Elements Agent version 23.7 available (internal version 23.7.416).

The endpoints automatically upgrade, without a reboot.

This release introduces new features and fixes, if interested enable Early access to client software in General Settings of your profile for selected endpoints.

Features:

New away option in automated tasks.

The away option allows to run automated task after user has been away for defined number of minutes. Example “@away 5” would run task after user have been away for 5 minutes.

New automated task to create restore point.

There is new automated task which allows to create system restore point in the client. This needs portal release, before the option is visible in automated tasks.

Improvements how windows operating system version is reported.

Client now sends also windows build number and build number is visible in the device details.

Remote action to turn off application control.

There is new remote action to turn off application control. This needs portal release, before the new option is visible in the menu.

Improved security events to contain information also about quarantined registry entries.

If rollback did happen and rollback did restore registry entries, the security event generated from the event was missing information about the restored registry entries. Now the event contains information about the restored registry entries.

Security scanning exclusions improvements

Now it is possible for administrators to enabled and disable individual rules, instead of removing the rules completely. Also, it is possible to write a comment for the exclusion. This need portal release to come active.

Running automated task from client user interface

It is possible to run automated task from the client user interface. Running task is only possible for administrative users and must be enabled from the profile separately. This needs new portal release before the option is available in the profile.

fedool2

A new version of the endpoint clients is available and our Early access program participants will start seeing it starting on 08.08.2023. Full availability starts one week later and takes some days to reach all customers.

This release makes the Elements Agent version 23.6 available (internal version 23.6.394).

The endpoints automatically upgrade, without a reboot.

This release introduces new features and fixes, if interested enable Early access to client software in General Settings of your profile for selected endpoints.

Features:

Report info about all currently logged in users so you can search devices user is logged on to.

We also report all recently logged in users so you can find devices where user was logged in recently.

Rollback feature sends alert when user restores Rollbacked files from quarantine (requires a portal release).

A new version of the endpoint clients is available and our Early access program participants will start seeing it starting on 13.06.2023. Full availability starts one week later and takes some days to reach all customers.

This release makes the Elements Agent version 23.5 available (internal version 23.5.378).

The endpoints automatically upgrade, without a reboot.

This release introduces new features and fixes, if interested enable Early access to client software in General Settings of your profile for selected endpoints.

Features:

Rollback feature is added to the client (requires a portal release)

Added new remote operation to edit local exclusion list from portal (requires a portal release)

Added new remote operation to restart Elements Agent right from the Elements Portal. Restarting services allows to fix various client problems without making a system reboot (requires a portal release)

Client now reports CPU information to the portal

Client now reports more information about shared folders and logged in users to portal

Client now reports if RDP is enabled on client so portal can show option to login with RDP

A new version of the endpoint clients is available and our Early access program participants will start seeing it starting on 09.05.2023. Full availability starts one week later and takes some days to reach all customers.

This release makes the Elements Agent version 23.4 available (internal version 23.4.163).

The endpoints automatically upgrade, without a reboot.

This release introduces new features and fixes, if interested enable Early access to client software in General Settings of your profile for selected endpoints.

Features:

It's possible to disable alerts for certain Application control rules.
Application control rules have a new setting "Security event" that can be used to define what kind of security event the rule triggers if any.

Administrator can disable Stop button of the Scanning dialog for USB scans to prevent end users from stopping the USB device scans. This feature can be enabled from the profile's Manual scanning page. Setting is "Action when USB storage device is plugged in".

Elements Agent WMI interface provides now RebootStatus class. This class contains two Properties.
- Pending (True/False)
- Reason ("swup" / "update" / "virus" / "spyware" / "critical" / "malfunction").

A new version of the endpoint clients is available and our Early access program participants will start seeing it starting on 05.04.2023. Full availability starts one week later and takes some days to reach all customers.

This release makes the Elements Agent version 23.3 available (internal version 23.3.570).

The endpoints automatically upgrade, without a reboot.

This release introduces new features and fixes, if interested enable Early access to client software in General Settings of your profile for selected endpoints.

Features:

This release is signed with a new WithSecure authenticode certificate. Very old installers don’t know this signature and will not trust it. If you use very old network installer - please upgrade to latest otherwise your installations will fail.

Upstream automatically discovered network shares and show them in portal

Upstream the UUID type the device was installed with and show it in portal (unique, smbios or adguid)

Added multiple proxies support. Portal profiles support now specifying multiple proxies and Connectors separated by semicolon. Please note that clients prior to 23.3 don’t support multiple proxies and may break so it’s advised to use it only with new clients or wait for all devices to upgrade to 23.3 first.

Delay automatic USB scan for 5 seconds to give device control time to disable the device if needed
Fix Connectivity report in fsdiag
This release checks accessibility of 2 new URLs: download.withsecure.com and guts2.fsapi.com.
These URLs will be taken into use in one of next versions so please verify they are not reported as not accessible for your devices

A new version of the endpoint clients is available and our Early access program participants will start seeing it starting on 24.02.2023. Full availability starts one week later and takes some days to reach all customers.

This release makes the Elements Agent version 23.2 available (internal version 23.2.1150).

The endpoints automatically upgrade, without a reboot.

This release introduces new features and fixes, if interested enable Early access to client software in General Settings of your profile for selected endpoints.

Features:

A new security event is triggered if Server Share Protection backup fails because folder does not exist.

Elements agent shows a flyer if browsing protection is enabled but browser extensions are not installed or not activated. This feature can be enabled from "Remind user to activate browser plugins" in Browsing protection settings of the portal's profile editor.
Elements Agent user interfaces have new WithSecure style.
Vulnerability scanning task will work in Element agent even if Automated tasks feature is disabled in profile.
Deploying Elements agent as Win32 app in MS Intune is supported.
"Hide exclusions from clients" option hides now exclusions also from the scan report.
Turn off security features turns off also features that are locked in the profile.
Network location settings changes also settings that are locked in the profile depending on the network location.
Software updater marks now updates as security updates faster than before.
Elements agent does not send empty IPv4 and IPv6 addresses to portal anymore.

A new version of the endpoint clients is available and our Early access program participants will start seeing it starting on 19.01.2023. Full availability starts one week later and takes some days to reach all customers.

This release makes the Elements Agent version 23.1 available (internal version 23.1.434).

The endpoints automatically upgrade, without a reboot.

This release introduces new features and fixes, if interested enable Early access to client software in General Settings of your profile for selected endpoints.

Features:

Support "Terminate running applications" toggle in Software Updater Automated Tasks.

Added a remote action to turn off Tamper Protection temporarily.

Added an alert to portal when user disables Tamper Protection locally.

You can now use remote operations to temporarily disable locked security features, no need to unlock them in profile. That way you don't need to weaken your security posture to be able to temporarily disable features.
"--upgrade-delay" parameter was added to network installer to allow to delay upgrades right after installation.
Improved upgrade functionality. Cleaning Windows Installers cache folder should not break upgrades anymore.

With this release we are changing file names for installers to be ElementsAgentInstaller.exe and ElementsAgentOfflineInstaller.msi. Old file names are still available to download but will not be published in future.

A new version of the endpoint clients is available and our Early access program participants will start seeing it starting on 15.12.2022. Full availability starts one week later and takes some days to reach all customers.

This release makes the Elements Agent version 22.9 available (internal version 4.40.394).

The endpoints automatically upgrade, without a reboot.

This release introduces new features and fixes, if interested enable Early access to client software in General Settings of your profile for selected endpoints.

Features:

UPGRADE_DELAY_MINUTES MSI parameter added to allow to postpone upgrade right after installation. It may be needed if your deployment system does not handle correctly self upgrade mechanisms.
Network share protection feature added (requires portal release).
Added a feature to Web Traffic Scanning to block content on safe sites as well (requires a new "Network interception framework core" channel update)
You don't need to download per portal installer anymore - PSB1 installer can be used to install products for all portals

Offline MSI is available to download from https://download.sp.withsecure.com/PSB/Pilot/OfflineInstallerCP-PSB1.msi

A new version of the endpoint clients is available and our Early access program participants will start seeing it starting on 21.11.2022. Full availability starts one week later and takes some days to reach all customers.

This release makes the Elements Agent version 22.8 available (internal version 4.39.527).

The endpoints automatically upgrade, without a reboot.

This release introduces new features and fixes, if interested enable Early access to client software in General Settings of your profile for selected endpoints.

Features:

Added a remote operation to temporarily enable debug logs via remote operation
Fixes and improvements for Endpoint encryption feature
Latest installed hotfix information reported to portal

A new version of the endpoint clients is available and our Early access program participants will start seeing it starting on 20.10.2022. Full availability starts one week later and takes some days to reach all customers.

This release makes the Elements Agent version 22.7 available (internal version 4.38.440).

The endpoints automatically upgrade, without a reboot.

This release introduces new features and fixes, if interested enable Early access to client software in General Settings of your profile for selected endpoints.

Features:

EULA links updated to show WithSecure EULA
Improvements to a new feature to send selected Windows Security Events to portal (requires new portal release and Premium subscription)
Added ability to change sample submit URL in browser block pages (requires new portal release)
We are continuing to change file and service descriptions and names to contain the WithSecure name